MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5968097175c88fe280b815302b9bf20b79971fbe914e2bca2fca9ce57b74fe0f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5968097175c88fe280b815302b9bf20b79971fbe914e2bca2fca9ce57b74fe0f
SHA3-384 hash: 20b2b7ce11d9be3b6ed2dfbae8d95138844db9f119e8ddbe56f3f44c2899ed6608f4222e8cb7690f024ae157db719f99
SHA1 hash: f1428afae645eeeed0d5450412584e1c99be044e
MD5 hash: c293aceae05bde11e51f4632e1adc316
humanhash: network-glucose-kilo-illinois
File name:zapytanie o zamówienie pdf.zip
Download: download sample
Signature Formbook
Create hunting rule
File size:475'658 bytes
First seen:2021-03-09 15:56:40 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:p8qdscx4C32HHIVoQ5Lgzd0naRk3vdoAtjeWIuqxgIeBw:plDx4CGHaSh4KAtqgqIBw
TLSH 5DA423D3D399B03CDBCF7F4451BF13029AA4351D2AB626DA8EAB0532EFDD0752622194
Reporter abuse_ch
Tags:geo POL zip


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: vps.promedic.com.mx
Sending IP: 174.136.28.112
From: Małgorzata Cieślak <export@gulertel.com>
Subject: Re: Re: zapytanie o nowe zamówienie
Attachment: zapytanie o zamówienie pdf.zip (contains "zapytanie o zamówienie pdf.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
115
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Zip_pdf.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Gathering data
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-03-09 15:57:07 UTC
AV detection:
9 of 47 (19.15%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=lfuas4lvzch6fafycuycxg7sbn4zoh56sfhcxsrpzkook63u7yhq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.40
Link:
https://yomi.yoroi.company/submissions/5968097175c88fe280b815302b9bf20b79971fbe914e2bca2fca9ce57b74fe0f

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

zip 5968097175c88fe280b815302b9bf20b79971fbe914e2bca2fca9ce57b74fe0f

(this sample)

Formbook

Executable exe 5e8ad6fd72d00c63a90eb501e353e2b5cb7fe122ad55d71a6d6e0fcf998ef910

  
Dropping
MD5 bbeb25509f9336d2ea526e71594da86b
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 5e8ad6fd72d00c63a90eb501e353e2b5cb7fe122ad55d71a6d6e0fcf998ef910

Comments